Watermarking input and output of a white-box implementation

A method of mapping an input message to an output message by a keyed cryptographic encryption operation, wherein the keyed cryptographic encryption operation includes a first round, including: performing a substitution function on a first portion of the input message to produce an output, wherein the substitution function incorporates a portion of a cryptographic key; and performing a watermarking function on the output, wherein the watermarking function produces a watermark output when the first input portion has a specific predetermined value, wherein the watermark output uniquely identifies the keyed cryptographic encryption operation.